GHSA-8qw9-gf7w-42x5
Minor fix to previous patch for CVE-2022-35918
GHSA-8qw9-gf7w-42x5 is a medium vulnerability (CVSS 5.3) in streamlit, published January 12, 2024. No source lists public exploit code. Fixed in streamlit 1.30.0.
- Severity
- 5.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.30.0streamlit +1 more
Description
Impact
The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.
Patches
We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security.
Workarounds
No additional workarounds are necessary once the update to version 1.30.0 is applied.
For more information
If you have any questions or comments about this advisory:
- Email us at security@streamlit.io
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
streamlitPyPI | 0.63.0 up to 1.30.0 | 1.30.0 |
streamlitPyPI | 0.63.0 up to 1.30.0, plus listed versions 0.63.10.64.00.65.00.65.10.65.2 Show 45 moreShow less0.66.00.67.00.67.10.68.00.68.10.69.00.69.10.69.20.70.00.71.00.72.00.73.00.73.10.74.00.74.10.75.00.76.00.77.00.78.00.79.00.80.00.81.00.81.10.82.00.83.00.84.00.84.10.84.20.85.00.85.10.86.00.87.00.88.00.89.01.0.01.1.01.10.01.10.0rc11.10.0rc21.11.01.11.0rc11.11.11.11.1rc11.12.01.12.0rc1 | 1.30.0 |
What each source reports
GitHub Advisories Score used
Minor fix to previous patch for CVE-2022-35918
Impact
The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.
Patches
We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security.
Workarounds
No additional workarounds are necessary once the update to version 1.30.0 is applied.
For more information
If you have any questions or comments about this advisory:
- Email us at security@streamlit.io
- Record
GHSA-8qw9-gf7w-42x5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Minor fix to previous patch for CVE-2022-35918
Impact
The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.
Patches
We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security.
Workarounds
No additional workarounds are necessary once the update to version 1.30.0 is applied.
For more information
If you have any questions or comments about this advisory:
- Email us at security@streamlit.io
- Record
GHSA-8qw9-gf7w-42x5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 61 versions. The JSON record has them.